PHP Release 8.2.28

    PHP 8.2.28 Release Announcement

    The PHP development team announces the immediate availability of PHP 8.2.28. This is a security release.

    All PHP 8.2 users are encouraged to upgrade to this version.

    For source downloads of PHP 8.2.28 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 8.2.28 (tar.gz)
    SHA256: 3318300888de5023720cc84efad5e005e53f30b5f0072fae65a750dabcaf6ec3
    PHP 8.2.28 (tar.bz2)
    SHA256: 2919cc1b92190a58dc17904b92e626600b96ce49a4c72e77513786a4406acce5
    PHP 8.2.28 (tar.xz)
    SHA256: af8c9153153a7f489153b7a74f2f29a5ee36f5cb2c6c6929c98411a577e89c91
    Change Logs
    core
    • Fixed bug GH-17211 (observer segfault on function loaded with dl()).
    libxml
    streams
    • Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    • Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    • Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    • Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
    windows
    • Fixed phpize for Windows 11 (24H2).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top